shc icon indicating copy to clipboard operation
shc copied to clipboard

After using the shc 4.0.3 encrypted shell script in Centos7, running the encrypted script and using ps ax can reveal the source code

Open panabit-li opened this issue 2 years ago • 2 comments

I found that after using shc - r - f test.sh - o test encryption, running ./test &, using ps ax | grep test, you can see the source code. The kernel is 3.10.0-1160.el7.x86_64

[root@localhost ~]# ps ax | grep test 10804 pts/0 S 0:00 ./test -c #!/bin/sh while true do sleep 1 done ./test 10844 pts/0 R+ 0:00 grep --color=auto test

After seeing someone using - U or - H to solve similar problems, I tried it and found that - U did not work. - H does not see the source code, but there will be a lot of processes.After I shut down the process related to test and used ps - A, I can see that there are still sh and sleep running

[root@localhost ~]# shc -o test -rH -f test.sh [root@localhost ~]# sudo ./test & [1] 11398 [root@localhost ~]# [root@localhost ~]# ps ax | grep test 11398 pts/0 S 0:00 sudo ./test 11400 pts/0 S 0:00 ./test 11401 pts/0 S 0:00 ./test 11436 pts/0 R+ 0:00 grep --color=auto test [root@localhost ~]# kill -9 11401 [root@localhost ~]# ps ax | grep test 11498 pts/0 R+ 0:00 grep --color=auto test [root@localhost ~]# ps -A ...................................... 11412 pts/0 00:00:00 sh 11513 pts/0 00:00:00 sleep 11514 pts/0 00:00:00 ps [root@localhost ~]#

What are some good ways I can solve this problem? I hope someone who knows or has experience can help me. Thank you very much

panabit-li avatar Oct 30 '23 07:10 panabit-li

It's a known limitation of shc. Take a look at my variant which uses pipe instead of command line: https://github.com/liberize/ssc

liberize avatar Jan 17 '24 15:01 liberize

It's a known limitation of shc. Take a look at my variant which uses pipe instead of command line: https://github.com/liberize/ssc

Thank you for your answer. I will try

panabit-li avatar Jan 18 '24 02:01 panabit-li